CVE Catalog
CVE-2026-42167
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk4.44%
90th percentile - higher than 90% of all known CVEs
Summary
A vulnerability in the mod_sql module of ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, when USER requests are logged with expansions like %U and the SQL backend allows commands (e.g., COPY TO PROGRAM).
Risk Assessment
An attacker can remotely execute arbitrary code on the ProFTPD server, potentially leading to full system compromise.
Recommendation
Update ProFTPD to version 1.3.9a or later, and restrict SQL backend permissions.
Original NVD description (English source)
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).